Review brief

Beginner20 min

An authentication service accepts a returnTo value after login. It may preserve an application-relative path or an absolute URL on the configured application origin, but it must never redirect to another authority or place control characters in a response header.

Behavioral contract

A missing or invalid target returns /dashboard.
A valid relative target starts with exactly one forward slash, contains no backslash or ASCII control character, and resolves on the application origin.
A valid absolute target uses https and its parsed origin exactly equals appOrigin; user-info and lookalike hostnames do not make another origin valid.
The returned string is safe to use directly as an HTTP Location value.

Review instructions

1Review the changed validator against the complete redirect grammar.
2Explain an exploit-shaped input for each security finding.
3Prioritize no more than three findings.

Learning objectives

• Validate URL structure instead of string prefixes
• Recognize alternate authority and path representations
• Protect response headers from control characters

src/safe-redirect.tsTypeScript

@@ -0,0 +1,20 @@

1+const FALLBACK_PATH = "/dashboard";

3+export function safeRedirectTarget(

4+ returnTo: string | undefined,

5+ appOrigin: string,

6+): string {

7+ if (returnTo === undefined || returnTo.length === 0) {

8+ return FALLBACK_PATH;

9+ }

10+

11+ if (returnTo.startsWith("/")) {

12+ return returnTo;

13+ }

14+

15+ if (returnTo.startsWith(appOrigin)) {

16+ return returnTo;

17+ }

18+

19+ return FALLBACK_PATH;

20+}

Reference solution

The findings below are ordered by priority.

Findings

1. A protocol-relative target can leave the application origin

Location: src/safe-redirect.ts:10-12

The slash prefix accepts values such as //attacker.example/path. A browser interprets that as an authority-relative URL rather than an application path, enabling an open redirect after login. Slash-and-backslash forms can also be normalized into another authority by URL consumers.

Parse against the configured origin and accept the relative form only when it begins with one forward slash, contains no backslash, and resolves to the exact origin.

2. An origin string prefix is not an origin check

Location: src/safe-redirect.ts:14-16

Values such as https://app.example.evil.test/ or https://app.example@evil.test/ can begin with the configured origin text while their parsed authority belongs to an attacker. The code also never enforces HTTPS on the candidate.

Parse the candidate URL, require the HTTPS scheme, reject user-info, and compare its origin property for exact equality.

3. Header control characters pass through unchanged

Location: src/safe-redirect.ts:10-16

A candidate beginning with an accepted prefix can still contain carriage returns, line feeds, or other ASCII controls. Returning it unchanged violates the direct-Location safety guarantee and can cause header injection in a response stack that does not reject it itself.

Reject every candidate containing an ASCII control character before returning it.

Reasonable non-findings

Falling back for an absent or empty target is correct.
Preserving a valid path's query string and fragment is allowed.
Returning the configured fallback constant does not require URL parsing.